1. Who this notice covers
HUGS is operated by Hugs Limited, registration number 120996, Unit G02, Eurocity, Europort Avenue, GX11 1AA Gibraltar. This notice covers website visitors, dashboard users, people interacting with HUGS widgets and people contacting customer service.
Privacy and legal contact: info@hugs.limited.
HUGS is offered to business customers worldwide, subject to applicable sanctions and other legal restrictions. People whose information is processed, including customer employees and widget users, retain their applicable privacy rights regardless of the business nature of the customer relationship.
HUGS and its customers
Hugs Limited is responsible as controller for the personal information it uses to manage its own business enquiries, customer relationships and service security. Where we process a customer's end-user information on that customer's instructions, the customer determines the purposes of that processing and its privacy notice also applies. The applicable service agreement and data processing terms define those responsibilities.
For requests concerning a customer's use of your information, contact that customer first. You can also contact HUGS so we can identify the relevant service and assist with routing your request.
2. Information involved
The contact form asks for your name, email address and a message about your use case. These fields are required to submit the form. Without them, the form cannot send your enquiry. Avoid including passwords, payment information or sensitive personal information.
Loading a website also sends technical request information to the servers that deliver its pages and resources. This can include an IP address, browser information and requested resource. The website currently requests fonts from Google. Sending the contact form transmits the form details to EmailJS for email delivery.
Dashboard, widget and customer service
Depending on the features used, service information can include account names and emails, customer and workspace associations, access roles, password hashes and authentication records, submissions and answers, review decisions, reward records and customer feedback. Login records can include IP addresses and browser information; feedback can include page URLs and contextual information.
Interaction records can include a user identifier, event name, feature, time and duration. We receive information directly from you, from your interaction with HUGS and, for customer-operated services, from the customer or its integration. Uploaded evidence and free-text messages can contain information supplied by a user or a customer's website.
Provide only information relevant to the service or request. Do not submit sensitive personal information or information about other people unless you are authorised to do so and it is necessary for the agreed service.
3. Purposes and legal grounds
The purpose of the contact form is to receive your enquiry and allow the HUGS team to respond about the requested service. Providing the website also involves delivering pages and protecting their availability.
Service purposes include account access and authentication, administering customer workspaces, processing submissions, recording activity and rewards, resolving support issues and protecting against misuse.
- Business enquiries and account administration: our legitimate interests in responding to requests and managing business relationships, subject to individuals' rights. Where you are personally a party to a contract, we may instead process information to perform it or take steps you request before entering it.
- Security and service operation: our legitimate interests in keeping the service reliable, investigating problems and preventing misuse, balanced against the impact on individuals.
- Legal records and requests: compliance with applicable legal obligations, including relevant tax-record requirements.
- Customer-controlled processing: the customer's documented instructions and the legal grounds identified in its own privacy information.
- Optional activities requiring consent: your consent where applicable law requires it. Submitting an enquiry is not blanket consent to unrelated marketing or tracking.
4. Services receiving information
We use external services to host our systems, deliver email and provide website resources. Those services receive information relevant to their role.
- Hosting and email providers: infrastructure for operating our systems and handling email.
- Postmark: transactional email, including messages used for account access.
- EmailJS: delivery of enquiries submitted through the public website's contact form. Its privacy information describes its own practices.
- Google Fonts: font resources requested by the public website, involving technical request information.
Authorised HUGS personnel and relevant customer workspace users may access information needed for their responsibilities. Information may also be disclosed to professional advisers or competent authorities where necessary for legal obligations or claims.
Providers may process information in countries outside your own. Applicable transfer requirements must be met, using a recognised adequacy basis or appropriate contractual safeguards where required. Contact us for details of the locations and safeguards relevant to your service, or to request information about the applicable safeguards.
See the Cookie Policy for cookies, browser storage and external resources.
5. Retention and security
Our retention policy is to keep personal information for the purpose it serves, delete or genuinely anonymise it when that purpose ends, and separately preserve records required by law or needed for a documented legal claim. Exceptions are limited to the necessary records rather than applied to all customer data.
- Unconverted enquiries: delete 12 months after the last substantive contact, unless an active negotiation justifies a documented extension.
- Routine support correspondence: delete 24 months after a ticket is closed, except relevant records retained for an unresolved dispute or legal obligation.
- Customer service data: retain while needed to provide the contracted service, subject to customer instructions and an agreed in-service schedule. After termination, allow a 30-day export window and delete remaining operational copies within 90 days of termination. This is not permission to keep every submission for the whole contract.
- Routine access/security logs and identifiable analytics: 90 days from creation, with separately justified incident records retained as needed. Any retained aggregate must be genuinely anonymous.
- Backups: expiry within 90 days of creation. Deleted data in backups is excluded from routine use, and deletion records are reapplied after restoration. Final expiry can occur after deletion from operational systems.
- Tax-return supporting records: preserve the records covered by Gibraltar's tax rules for six years from the end of the relevant reporting period, and longer where the applicable enquiry or legal-preservation rules require. This is not a blanket six-year retention period for all personal information.
During a customer contract, retention of submissions, uploads and reward evidence depends on the agreed service purpose, customer instructions and any need to resolve a dispute. Routine analytics follows the shorter period above. Email-delivery providers can retain their own delivery records under their applicable settings; these are distinct from correspondence retained in HUGS mailboxes. Contact us for information about a particular record or service.
Security measures must be appropriate to the information and risks involved. No online service can guarantee absolute security. Report suspected misuse or unauthorised access to our contact address without including passwords or authentication codes.
6. Your privacy rights
Depending on applicable law and the circumstances, you may have rights to access and correct your information, request deletion or restriction, object to processing, and obtain a portable copy. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing. You may also complain to the relevant data protection authority.
For Gibraltar data protection matters, the Gibraltar Regulatory Authority provides information about rights and complaints. This does not prevent you from contacting another authority where applicable law allows.
Send requests to info@hugs.limited, identifying the service and information concerned. We may need proportionate information to establish your identity or authority. We will address requests within the time required by applicable law. If a request concerns processing controlled by a customer, we will assist that customer as appropriate.
Features involving reviews, access decisions or rewards may process activity and submission information. Contact us, or the relevant customer, for an explanation of a decision affecting you and to request review where applicable.
7. Changes and scope
Updates will be published on this page with a revised date. Where required, material changes will be brought to affected users' attention. This notice does not replace a customer's privacy notice, customer-specific data processing terms or separate information provided for a particular activity.